BestFriends.scr Information Bar Help

Unknown
edited November 2004 in Spyware & Virus Removal
So I had BestFriends.scr a few weeks ago, and thanks to Windows XP SP2 (I never thought I'd actually be for SP2's annoying information bar...) it was blocked from installing.

The only problem is that now the information bar seems to be screwed up, displaying for almost every site I visit, saying "To help protect your security, Internet Explorer has restricted this file from showing active content that could access your computer. Click here for more options..."

I've been trying to fix the problem myself over the last few days, but have had no luck -- and this information bar is annoying the hell out of me. I saw this problem posted elsewhere, but I couldn't follow the steps to fix the problem (ran LSP-Fix, but didn't get the same results). I've scanned with Ad-aware SE and Spybot. Below is my HijackThis log, anybody's help would be appriciated.

== start log ==

Logfile of HijackThis v1.98.2
Scan saved at 5:43:40 PM, on 10/26/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\WINDOWS\svchost.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Folding@Home\winFAH.exe
C:\Program Files\YzShadow\YzShadow.exe
C:\Program Files\Folding@Home\FahCore_65.exe
C:\Program Files\Trillian\trillian.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S00RN1.EXE
C:\Program Files\Common Files\EPSON\EBAPI\EBRR.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Andrew Dunkman\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://titantv.com/TTV/Grid/Grid.aspx
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\DOCUME~1\ANDREW~1\LOCALS~1\Temp\1123.exe" -atboottime
O4 - HKLM\..\Run: [WinLoad] C:\WINDOWS\system32\explorer32\Winload.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKCU\..\Run: [Clock] C:\WINDOWS\subst.exe
O4 - Startup: Folding@Home 5.02.lnk = ?
O4 - Startup: YzShadow.lnk = C:\Program Files\YzShadow\YzShadow.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095728580780
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

== end log ==

Thanks! Andrew

Comments

  • KwitkoKwitko Sheriff of Banning (Retired) By the thing near the stuff Icrontian
    edited October 2004
    Remove these:
    O4 - HKLM\..\Run: [QuickTime Task] "C:\DOCUME~1\ANDREW~1\LOCALS~1\Temp\1123.exe" -atboottime
    O4 - HKLM\..\Run: [WinLoad] C:\WINDOWS\system32\explorer32\Winload.exe
    C:\WINDOWS\svchost.exe (SVCHOST should only reside in the system32 folder.)

    Reboot and post a new log.
  • ADunkman
    edited October 2004
    Thanks for the quick responce -- Done what you've asked (and noticed the [clock] entry changed after rebooting, and researched to find it also malware, so I have removed that.)

    == start log ==

    Logfile of HijackThis v1.98.2
    Scan saved at 10:04:30 PM, on 10/26/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
    C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Network Associates\VirusScan\VsStat.exe
    C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    C:\Program Files\Network Associates\VirusScan\Webscanx.exe
    C:\Program Files\Network Associates\VirusScan\Avconsol.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\explorer32\WinsysMngr.exe
    C:\WINDOWS\system32\explorer32\explorer.exe
    C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
    C:\WINDOWS\system32\taskswitch.exe
    C:\WINDOWS\system32\PELMICED.EXE
    C:\WINDOWS\subst.exe
    C:\Program Files\Folding@Home\winFAH.exe
    C:\Program Files\YzShadow\YzShadow.exe
    C:\Program Files\Netropa\Onscreen Display\OSD.exe
    C:\Program Files\Folding@Home\FahCore_65.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Andrew Dunkman\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://titantv.com/TTV/Grid/Grid.aspx
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat

    6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

    files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
    O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
    O4 - Startup: Folding@Home 5.02.lnk = ?
    O4 - Startup: YzShadow.lnk = C:\Program Files\YzShadow\YzShadow.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program

    files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

    http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095728580780
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

    http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

    == end of log ==

    Thanks. Andrew
  • SpywareShooterSpywareShooter 127.0.0.1
    edited October 2004
    Your log looks okay now. Are you still having any problems?
  • ADunkman
    edited October 2004
    Yes, Information Bar keeps displaying the message "To help protect your security, Internet Explorer has restricted this file from showing active content that could access your computer. Click here for more options..." on almost every site that I visit.
  • wanggen
    edited November 2004
    ADunkman wrote:
    Yes, Information Bar keeps displaying the message "To help protect your security, Internet Explorer has restricted this file from showing active content that could access your computer. Click here for more options..." on almost every site that I visit.


    Found where the problems is... The following key was altered

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
    change the key (http) from 0 to 3
  • ADunkman
    edited November 2004
    THANK YOU SO MUCH, the annoying problem is gone. Send me an email sometime if you ever need anything in return.

    Thanks again, Andrew
This discussion has been closed.